CVE-2009-0037

🗓️ 05 Mar 2009 02:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

Curl and libcurl 5.11-7.19.3 accept arbitrary Location values, leading to potential remote attacks

Reporter	Title	Published	Views	Family All 112
FreeBSD	curl -- cURL/libcURL Location: Redirect URLs Security Bypass	3 Mar 200900:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 6 package curl version 7.19.4-alt1	3 Mar 200900:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 8 package curl version 7.19.4-alt1	3 Mar 200900:00	–	altlinux
BDU FSTEC	The vulnerability of the Gentoo Linux operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
Tenable Nessus	CentOS 3 / 4 : curl (CESA-2009:0341)	20 Mar 200900:00	–	nessus
Tenable Nessus	Debian DSA-1738-1 : curl - arbitrary file access	12 Mar 200900:00	–	nessus
Tenable Nessus	Fedora 10 : curl-7.19.4-1.fc10 (2009-2247)	23 Apr 200900:00	–	nessus
Tenable Nessus	Fedora 9 : curl-7.19.4-1.fc9 (2009-2265)	6 Mar 200900:00	–	nessus
Tenable Nessus	FreeBSD : curl -- cURL/libcURL Location: Redirect URLs Security Bypass (5d433534-f41c-402e-ade5-e0a2259a7cb6)	5 Mar 200900:00	–	nessus
Tenable Nessus	GLSA-200903-21 : cURL: Arbitrary file access	10 Mar 200900:00	–	nessus

NVD

Node

curl curlMatch5.11

curl curlMatch6.0

curl curlMatch6.1beta

curl curlMatch6.2

curl curlMatch6.3

curl curlMatch6.3.1

curl curlMatch6.4

curl curlMatch6.5

curl curlMatch6.5.1

curl curlMatch6.5.2

curl curlMatch7.1

curl curlMatch7.1.1

curl curlMatch7.2

curl curlMatch7.2.1

curl curlMatch7.3

curl curlMatch7.4

curl curlMatch7.4.1

curl curlMatch7.4.2

curl curlMatch7.5

curl curlMatch7.5.1

curl curlMatch7.5.2

curl curlMatch7.6

curl curlMatch7.6.1

curl curlMatch7.7

curl curlMatch7.7.1

curl curlMatch7.7.2

curl curlMatch7.7.3

curl curlMatch7.8

curl curlMatch7.8.1

curl curlMatch7.8.2

curl curlMatch7.9

curl curlMatch7.9.1

curl curlMatch7.9.2

curl curlMatch7.9.3

curl curlMatch7.9.4

curl curlMatch7.9.5

curl curlMatch7.9.6

curl curlMatch7.9.7

curl curlMatch7.9.8

curl curlMatch7.10

curl curlMatch7.10.1

curl curlMatch7.10.2

curl curlMatch7.10.3

curl curlMatch7.10.4

curl curlMatch7.10.5

curl curlMatch7.10.6

curl curlMatch7.10.7

curl curlMatch7.10.8

curl curlMatch7.11.1

curl curlMatch7.12

curl curlMatch7.12.1

curl curlMatch7.12.2

curl curlMatch7.13

curl curlMatch7.13.2

curl curlMatch7.14

curl curlMatch7.14.1

curl curlMatch7.15

curl curlMatch7.15.1

curl curlMatch7.15.3

curl curlMatch7.16.3

curl curlMatch7.16.4

curl curlMatch7.17

curl curlMatch7.18

curl curlMatch7.19.3

curl libcurlMatch5.11

curl libcurlMatch7.12

curl libcurlMatch7.12.1

curl libcurlMatch7.12.2

curl libcurlMatch7.12.3

curl libcurlMatch7.13

curl libcurlMatch7.13.1

curl libcurlMatch7.13.2

curl libcurlMatch7.14

curl libcurlMatch7.14.1

curl libcurlMatch7.15

curl libcurlMatch7.15.1

curl libcurlMatch7.15.2

curl libcurlMatch7.15.3

curl libcurlMatch7.16.3

curl libcurlMatch7.19.3

Source	Link
oval	www.oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054
curl	www.curl.haxx.se/lxr/source/CHANGES
secunia	www.secunia.com/advisories/34138
secunia	www.secunia.com/advisories/34255
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/49030
securitytracker	www.securitytracker.com/id
secunia	www.secunia.com/advisories/35766
vmware	www.vmware.com/security/advisories/VMSA-2009-0009.html
vupen	www.vupen.com/english/advisories/2009/0581
support	www.support.apple.com/kb/HT4077

Parameter	Position	Path	Description	CWE
Location	header	withdk.com/malicious-redirect	Arbitrary file/command access via HTTP redirect when FOLLOWLOCATION is enabled; remote server can redirect to file:// or scp: URLs (CVE-2009-0037).	CWE-352

16 Jun 2026 23:04Current

7.8High risk

Vulners AI Score7.8

CVSS 26.8

EPSS0.0905

CWE-352